DNS-over-HTTPS (DoH) Resolver Bypass — Client Contacting Public DoH Endpoint
18 DNS Do H Bypass
Query
let DohEndpoints = dynamic([
"dns.google", "dns.google.com", "cloudflare-dns.com", "mozilla.cloudflare-dns.com",
"chrome.cloudflare-dns.com", "one.one.one.one", "doh.opendns.com", "dns.quad9.net",
"doh.cleanbrowsing.org", "dns.nextdns.io", "doh.dns.sb", "dns.adguard.com",
"dns.adguard-dns.com", "doh.libredns.gr", "doh.mullvad.net", "dns.cloudflare.com"]);
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where DnsQueryTypeName in~ ("A", "AAAA")
| extend q = tolower(DnsQuery)
| where q in~ (DohEndpoints)
or q has "cloudflare-dns.com" or q has "doh." or q has "dns.google"
or q has "nextdns.io" or q has "dns.quad9"
| summarize
DohLookups = count(),
Providers = make_set(DnsQuery, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostnameExplanation
This query is designed to detect internal clients that are attempting to bypass corporate DNS filtering by using public DNS-over-HTTPS (DoH) resolvers. It specifically looks for initial DNS queries (A/AAAA records) to known public DoH endpoints, such as dns.google or cloudflare-dns.com. Once a client resolves one of these endpoints, it can potentially tunnel all subsequent DNS queries over HTTPS, thereby evading corporate DNS controls and telemetry.
The query runs every hour and checks DNS activity logs for any queries to these public DoH endpoints. If such queries are detected, it summarizes the number of lookups, the specific DoH providers queried, and the time range of these activities. The results are grouped by the source IP address and hostname of the client making the queries.
Alerts are generated if any such activity is detected, providing details about the host and the number of lookups performed. This helps in identifying potential evasion techniques used by malware or unauthorized applications that could be bypassing security measures.
Key points:
- Detects attempts to use public DoH resolvers to bypass corporate DNS filtering.
- Monitors DNS queries for known DoH endpoints.
- Provides alerts with details on the host and number of queries detected.
- Helps identify potential security evasion techniques.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
Frequency: 1h
Period: 1h